Spinnaker Release 2026.3.0

Breaking Changes

WARNING: This release has MAJOR breaking changes and you should heavily validate this release carefully! It has significant new features and the UI has been heavily cleaned up with angular removed for React.

AWS V2 SDK migration

The caching agents and code have been moved to the AWS V2 SDK. Any V1 usage via plugins or similar will no longer work going forward.

GCE: Compute API beta to stable v1

Spinnaker PR #7510 migrates the Google provider from the Compute beta API to stable v1. Before upgrading, check saved GCE Deploy stages for the fields below.

partnerMetadata is no longer propagated

Stable Compute v1 instance template requests do not support the beta-only partnerMetadata field. Clouddriver continues to accept saved deploy and clone payloads that contain the field, but removes it before creating the instance template and logs a warning. The pipeline can still run, but the partner metadata is not applied.

Remove partnerMetadata from saved pipeline JSON. If an integration depends on its namespaced structured data, consult that integration’s migration guidance; there is no automatic conversion to a stable-v1 field.

Use Resource Manager tags when they match the use case

resourceManagerTags is not a drop-in replacement for partnerMetadata. Resource Manager tags bind pre-created GCP tag keys and values to instances for organization, policy, and access-control use cases. They do not carry arbitrary partner-integration data.

For a tag key named environment under organization 123456789012, with a tag value named production, use this deploy-stage field:

{
  "resourceManagerTags": {
    "123456789012/environment": "production"
  }
}

GCP also accepts numeric resource names such as tagKeys/123456789 and tagValues/987654321. The tag keys and values must exist before the pipeline runs. See the Compute v1 instance template resourceManagerTags contract for accepted key and value formats.

Remove autoHealingPolicy.maxUnavailable

Stable Compute v1 MIG auto-healing policies support healthCheck and initialDelaySec; they do not support maxUnavailable. Clouddriver rejects a saved deploy stage containing any non-null maxUnavailable value, including an empty object, rather than silently discarding a safety setting.

Before:

{
  "autoHealingPolicy": {
    "healthCheck": "example-health-check",
    "healthCheckKind": "healthCheck",
    "initialDelaySec": 300,
    "maxUnavailable": {
      "fixed": 2
    }
  }
}

After:

{
  "autoHealingPolicy": {
    "healthCheck": "example-health-check",
    "healthCheckKind": "healthCheck",
    "initialDelaySec": 300
  }
}

In updated Deck, edit and save each affected GCE Deploy stage; Deck rebuilds the command with supported fields and removes maxUnavailable. Pipelines managed through the API or as custom JSON must remove the field explicitly.

Do not move this value to updatePolicy.maxUnavailable as a mechanical migration. That setting controls rolling updates, not auto-healing repair concurrency.

See the stable v1 instance group manager contract for the supported autoHealingPolicies fields.

Angular removed

Angular has been removed from the Spinnaker project. For any plugins or forks, please migrate to React. This is a substantial migration — a big thank you to the contributors, primarily Matt Gogerly.

SAML configuration has moved to Spring configuration

A few properties remain that enable parsing users and translating custom fields, but all content has moved to native Spring SAML configuration. Full migration docs are available .

For a minimal example:

saml:
  enabled: true
  user-attribute-mapping:
    email: email
    roles: memberOf
  # This is defaulted and not required, but you MUST set the ACS URL below
  login-processing-url: /saml/SSO

spring:
  security:
    saml2:
      relyingparty:
        registration:
          SSO:                          # registration ID (arbitrary key, used in URLs, set here to SSO to mimic Spinnaker behavior)
            acs:
              # Keeps older login URLs for now.
              location: "{baseUrl}/saml/SSO"
            entity-id: spinnaker
            assertingparty:
              metadata-uri: https://idp.example.com/saml/metadata
              singlesignon:
                sign-request: true
            signing:
              credentials:
                - private-key-location: /etc/gate/saml/private_key.pem
                  certificate-location: /etc/gate/saml/certificate.pem

Removals and Deprecations

Binaries & core utilities upgraded/removed

Upgrades/removal of old versions — many older libraries and SDKs have been upgraded and/or removed. Some of these (like Helmfile) do not receive as much testing as we’d like, so please verify if you use these libraries.

  • Kustomize 5 is added. Kustomize 4 is updated to the latest supported version.
  • Helmfile is upgraded to 1.7.0.
  • Packer is upgraded to the latest release (1.14).
  • kubectl binaries used for operations are updated to 1.30. Older versions are removed. You can select a newer version.
  • aws-iam-authenticator binary is upgraded to the latest supported version.
  • Base images are upgraded from Alpine 3.20 to 3.24. Ubuntu is moved to the latest release.

Native metric feeds to stackdriver will removed in 2026.4.0

Native feeds of spectator to stackdriver are deprecated and will be removed in 2026.4.0. Spectator as a whole hasn’t been supported in the project since the observability plugin and will be migrated to native spring metrics based (which uses micrometer) for metric handling.

Spectator to beremoved in 2027.0.0

There’s already work in progress to migrate from spectator to native spring metrics based upon micrometer. This will be fully removed in 2027.0.0

Old Kubernetes resource types removed

Very old API specs are removed . Specifically:

  • extensions/v1beta1
  • networking.k8s.io/v1beta1

Associated libraries for Kubernetes are also upgraded to a currently supported release. This removes support for any resources using these types — please update your plugins as appropriate. These API versions were removed in Kubernetes 1.22.

Halyard removed

Halyard is removed from the codebase as of this release. For emergency fixes, PRs can be made to the 2026.2.x release branch. Halyard will no longer be released or actively supported, though it may continue to work as we will continue publishing BOMs for now. As of 2027.0.0, we will stop publishing Halyard BOMs.

Kustomize version 3 deprecated — will be removed in 2027.0.0

Kustomize V3 is deprecated. When using Kustomize in a pipeline, this is what’s referenced when you select KUSTOMIZE as the rendering type. Kustomize 5 is being added, and Kustomize 4 will continue to be supported. With 2027.0.0, Kustomize 3 will be removed. Please upgrade your pipelines to Kustomize 4 or 5 before that release.

SQL is the only supported storage for execution data — Redis will be removed in 2027.0.0

In Orca (the execution engine), we are deprecating support for any pipeline storage other than SQL. Please migrate your executions to SQL as soon as possible. Redis-based storage of pipeline execution state will be removed in 2027.0.0. Note: this only impacts storage of pipelines, not the queue system. It is recommended to stay on Redis for the queue system at this time.

Titus deprecated — will be removed in 2027.0.0

Given the lack of contributions, the Titus cloud provider will be removed in an upcoming release. It is marked deprecated as of this release.

SQL is the only supported storage for pipelines/templates — blob storage will be removed in 2027.0.0

Front50 currently supports S3/GCS/etc. storage for pipelines and templates. This will be removed in 2027.0.0. See the instructions on how Netflix migrated to move before that release. All non-SQL storage for Front50 is now marked deprecated.

Features

New stage to run multiple child pipelines from one call

There’s a new stage to invoke multiple child pipelines in a single stage vs creating multiple stages to invoke those child pipelines. Add this stage, and add the following config to invoke multiple child pipelines with this:

bundle_web:
  appName1:
    arguments:
      app: app1
      deploymentFrezeOverride: true
      skipCanary: true
      tag: 1.1.1
      targetEnv: targetEnv
    child_pipeline: childPipeline
  appName2:
    arguments:
      app: app2
      deploymentFrezeOverride: true
      skipCanary: true
      tag: 1.1.1
      targetEnv: targetEnv
    child_pipeline: childPipeline
    depends_on:
      - appName1

This will then call the appName1 pipeline “childPipeline” as well as the appName2 childPipeline AFTER the appName1 pipeleine completes. This enables you to invoke multiple pipelines with different arguments as needed to do a more dynamic invocation of child pipeline executions. For rollback on failure handling, YOU MUST create in that down stream application a pipeline named “rollbackOnFailure” to handle rollbacks.

Evaluate Artifacts stage

Evaluate Artifacts — A new pipeline stage that evaluates SpEL expressions inside artifact contents and produces embedded/base64 artifacts. Each artifact is evaluated sequentially, so a later artifact can reference the evaluated value of an earlier one. This makes it easier to generate artifacts dynamically within a pipeline.

To use the stage, add one or more artifacts with a display name and contents. Contents may include any SpEL expression available in the pipeline context. The stage outputs the resulting artifacts so they can be consumed by downstream stages.

Configurable timeout on manifest stable checks

Kubernetes manifest stable time — Kubernetes deploys previously had a fixed 30-minute timeout before Deployments were considered “stable.” This timeout is now configurable via a pipeline parameter.

Multi-pipeline runner

Multi-pipeline runner — This plugin enables calling several child pipelines dynamically via a configuration block. For more information and configuration options, see the linked PR.

New scheduler system (Alpha)

Pub/Sub Cloud Account Scheduler — A new scheduler that processes requests for caching and agent operations in order. The current Redis scheduler is non-deterministic about when agents are processed, so users with large numbers of accounts may not get their data processed in a timely manner. This new scheduler exposes endpoints, stores agent state, and surfaces more detailed metrics on agent executions.

To try it out, disable the current Redis scheduler and enable this via:

spring:
  data:
    redis:
      url: redis://valkey:6379

cats:
  pubsub:
    enabled: true
    # Interval between state checks and re-queuing requests for additional processing.
    delayBetweenSchedulerRunsMs: 15000
    # When an agent is removed (e.g. account deletion), it is marked for deletion. This controls when it is actually removed. Time is in minutes. Defaults to 3 hours.
    minutesBeforeDeletingMarkedForDeletion: 180
    # If an agent hasn't been processed for some reason (e.g. lost in the queue), requeue it after this period.
    minutesBeforeReQueueOfAgents: 20
    # Strict concurrency limit on how many agents will run simultaneously. Similar to max-concurrent-agents in other schedulers.
    maxConcurrentAgents: 100
    # Max length of the Redis streams used for picking up agents to run. Set this large if you have many agents.
    # Rough estimate: every AWS account adds ~15 agents per region. 100 accounts × 4 regions × 15 = 6,000 agents minimum.
    # This defaults to 100,000. Note: this value directly affects Redis memory usage.
    streamMaxLength: 100_000

This is an initial step toward using streams to request information rather than polling on a fixed cycle, and enables future alternative agent operation strategies.

Global banner for admins

Global banner — Admins can create and set banners visible across all Spinnaker applications for global notifications.

Spin CLI API token support

The new API token can be used with the Spin CLI. This is available in current main images.

UI support for adding/removing accounts

Admin-restricted. Adds a new UI panel to add and remove accounts with example payloads.

GitHub App authentication for git/repo and github/file artifacts

Clouddriver artifact accounts of type git/repo and github/file can now authenticate as a GitHub App instead of using a personal access token, username/password, or SSH key. Installation tokens are minted automatically, cached, and refreshed before they expire — no external token rotation is needed.

artifacts:
  git-repo:
    enabled: true
    accounts:
      - name: my-github-app-repo
        githubApp:
          appId: "123456"
          # Plain path or an encrypted secret URI, e.g. encryptedFile:secrets-manager!r:us-west-2!s:gh-app-private-key
          appPrivateKeyPath: /secrets/gh-app-key.pem
          # optional - when omitted, the installation is derived from the repository being
          # accessed, so one account can serve repositories across several organizations
          appInstallationId: "789012"
          # optional - when the installation is derived, restricts which repository owners
          # this account may access. Omitting it allows any organization where the app is installed.
          allowedOrganizations:
            - my-org
            - my-other-org
          # apiBaseUrl: https://ghe.example.com/api/v3  # optional, for GitHub Enterprise

The same githubApp block is supported under artifacts.github.accounts. When present, GitHub App authentication takes precedence over the other auth methods on the account.

Installation tokens are cached per installation and refreshed shortly before they expire, so cached tokens are served without any GitHub API calls. When appInstallationId is omitted, the installation is resolved from the repository being accessed (organization- and user-owned repositories are both supported), which requires the app to be installed there with access to that repository; that resolution also happens only when a token is minted.

Because the repository is chosen by whoever defines the artifact, an account without appInstallationId can reach every organization where the app is installed. Set allowedOrganizations to restrict it to a known set of repository owners; a warning is logged at startup for accounts that derive installations without one. The list is matched case-insensitively and is ignored when appInstallationId pins a single installation.

Note that GitHub App clones use HTTPS (via x-access-token), so SSH-style repo URLs (git@...) are not supported with this auth method. For github/file accounts without a pinned appInstallationId, setting useContentAPI: true is recommended so that downloads are served by a single contents-API request that identifies the repository.

For plugin and fork authors: supporting this required a change to clouddriver’s shared artifact base class. BaseHttpArtifactCredentials.getHeaders(T account) now declares throws IOException, and a getHeaders(T account, HttpUrl url) overload was added for credentials whose auth material depends on the URL being fetched (it delegates to the URL-agnostic method by default). This is binary-compatible, but any out-of-tree subclass that overrides getHeaders and calls super.getHeaders(...) needs the same throws IOException on its signature to recompile. The GitHub App support itself lives in the new kork-github module, which clouddriver’s github/file and git/repo artifact modules now depend on.

  • accounts: Add a UI to help with adding/removing accounts (#7799) ( b86ea73c )
  • artifacts: support GitHub App authentication for git/repo and github/file artifact accounts (#7897) ( 8f1801da )
  • aws: Warm pool support (#7852) ( 883076d1 )
  • aws: migrate remaining v1 EC2/AutoScaling client calls to SDK v2 (#7942) ( 9981a47d )
  • cats: Concept for a pub/sub scheduler. (#7399) ( db99dd91 )
  • clouddriver-aws: migrate SNS, SQS, SWF, Support, CloudFormation to AWS SDK v2 (#7903) ( b751755f )
  • cloudfoundry: migrate RouteService and ConfigService from v2 to v3 API (#7800) ( b2ddea28 )
  • core: make pipeline-trigger execution dropdown limit configurable (#7770) ( f9bd3fc6 )
  • deck/kubernetes: remove angular dependency (#7765) ( be144176 )
  • deck: Add org/repo/path URL builder for git file artifacts (#7916) ( 6c583676 )
  • ecs: migrate ECS core agents to AWS SDK v2 EcsClient (#7759) ( 1c1b6500 )
  • ecs: migrate TargetHealthCachingAgent to AWS SDK v2 ELBv2 (#7895) ( 99c6f15e )
  • ecs: migrate atomic operations and scalable targets to AWS SDK v2 (#7896) ( 42182b2f )
  • evaluateArtifacts: Add evaluateArtifacts stage - SpeL enabled embdedded artifacts (#7845) ( 1257329f )
  • front50: deprecate non-SQL metadata storage backends (#7886) ( af1d3a4e )
  • gitlab-ci: Add pipeline trigger, cancel, and StoppableBuildService interface (#7885) ( b5b7f1de )
  • globalBanners: Adding a Global Banner functionality managed by admins (#7781) ( 089ce81d )
  • gradle: Upgrade to gradle 9 (bumps kotlin to 2.1 release) (#7790) ( b58c1be3 )
  • halyard: add kork-secrets-k8s dependency (#7788) (#7789) ( 394393c8 )
  • halyard: add kork-secrets-k8s dependency (#7788) ( 62a3094e )
  • helmfile: Adds the ability to use artifacts as helmfile overrides ( 8db2ef0f )
  • helmfile: Expose environment and namespace arguments. Add some validation around them and helper text (#7890) ( 4606c99d )
  • kayenta: Add clickhouse as a canary provider (#7911) ( 3a5bc5fb )
  • kubernetes: Bump SDK and tests to remove OLD kubernetes support. Removes some long dead API response handling and manifest handling (#7802) ( cbe18108 )
  • kubernetes: Enable a dynamic timeout on manifest stabilize operations. (#7804) ( 1843850f )
  • lambdaInvoke: Opt-In in resolving in Orca the Invoke payload artifact (#7867) (#7868) ( a50144fc )
  • lambdaInvoke: Opt-In in resolving in Orca the Invoke payload artifact (#7867) ( 0bde42b2 )
  • logs: Add an autorefresh logs button thing to do logs (#7820) ( 23ddf4c7 )
  • mcp: Add a spinnaker native MCP server (#7910) ( 5a4b62b5 )
  • orca-local.yml: tasks: monitor-aws-code-build: backoff-period: 30000 timeout: 28800000 Closes: https://github.com/spinnaker/spinnaker/issues/7849 (#7855) ( 97906283 )
  • orca/deck: add runMultiplePipelines stage from Armory multiple-pipelines plugin (#7803) ( 2d782001 )
  • provider/google, deck/google: GCE Compute v1 migration and instance flexibility policy (#7510) ( 2e065748 )
  • pubsub/aws: migrate kork-pubsub-aws from AWS SDK v1 to v2 (#7912) ( d997b0ff )
  • spin: Add ApiToken support to the spin cli (#7782) ( d99bc1a7 )

Configuration

Fixes

PostgreSQL compression issue

PostgreSQL compression failures — When using PostgreSQL with Orca database compression, failures occurred due to library upgrades. This is now fixed.

Large YAML support

Large YAMLs could fail to load — Following prior snakeyaml upgrades, some parts of Spinnaker did not allow customization of the maximum YAML size (for example, Helm repo indexes). These configurable limits are now universally applied.

Fixed a bug on account APIs

In cert

  • accounts: Fix a race condition on dynamic accounts loading (#7791) ( ce4509c1 )
  • amazon: fix AMI selection in Create Server Group image picker (#7965) ( 2a83323a )
  • amazon: restore pipeline stage config fields dropped by Angular removal (#7955) ( f0301b62 )
  • appengine: restore dropped fields on server group stages (#7957) ( 2cb49583 )
  • artifacts: prevent SSRF via HTTP redirect in Helm and Jenkins artifact accounts (#7756) ( b9c9300d )
  • aws: Fix wiring issue with autoconfiguration - changed to a non-autowiring library (#7927) ( d75362a2 )
  • aws: bridge v1 credentials to v2 in AmazonCredentials.getV2CredentialsProvider() AmazonCredentials.getV2CredentialsProvider() returned DefaultCredentialsProvider which cannot discover AWS credentials in non-AWS environments (e.g. GKE pods). All Spinnaker accounts have a configured v1 AWSCredentialsProvider that already handles STS assume-role with token refresh, but the v2 path ignored it entirely. Bridge the v1 provider to v2 by adapting each resolved credential (supporting both session and basic credentials). This makes the v2 SDK path work everywhere the v1 path works, without requiring a separate v2 credential discovery chain. Also removes the now-unnecessary override from NetflixAssumeRoleAmazonCredentials since the base class handles it for all subclasses. (#7766) (#7767) ( 160c50ab )
  • aws: bridge v1 credentials to v2 in AmazonCredentials.getV2CredentialsProvider() AmazonCredentials.getV2CredentialsProvider() returned DefaultCredentialsProvider which cannot discover AWS credentials in non-AWS environments (e.g. GKE pods). All Spinnaker accounts have a configured v1 AWSCredentialsProvider that already handles STS assume-role with token refresh, but the v2 path ignored it entirely. Bridge the v1 provider to v2 by adapting each resolved credential (supporting both session and basic credentials). This makes the v2 SDK path work everywhere the v1 path works, without requiring a separate v2 credential discovery chain. Also removes the now-unnecessary override from NetflixAssumeRoleAmazonCredentials since the base class handles it for all subclasses. (#7766) ( b665a0ec )
  • build: Minor but on a new branch,t he publish-debs was passed to deck-kayenta which doesnt accept that as an input. Switch to publish-npm which already defaults to true but make it an explicit true (#7758) ( 934349af )
  • build: Set group name on all root projects (#7834) (#7857) ( f7246ac3 )
  • build: Set group name on all root projects (#7834) ( 5213400d )
  • build: Temporary fix to ignore closing a staging repo (#7763) (#7764) ( 6964c765 )
  • build: Temporary fix to ignore closing a staging repo (#7763) ( 54242c05 )
  • builds: Fix spin cli builds due to gradle 9 upgrade (#7882) ( 16458dfe )
  • cdevents: Fix empty cdevents status response issue (#7818) ( c10459ea )
  • change: fix: resolve CVE findings in commons-compress, logback, httpcore5, tomcat-embed, and Netty/Log4j BOM precedence (#7877) ( 66d80569 )
  • change: fix: run-as-non-root-10 (#7864) ( 16d3813b )
  • ci: bump pinned QEMU binfmt image from v7.0.0-28 to v10.2.3-68 (#7970) (#7971) ( 398e3624 )
  • clouddriver: Fix UnsupportedOperationException/NullPointerException regressions from AWS SDK v2 migration (#7952) ( 5fcb27e4 )
  • cve: Fix an old CVE version of kayenta signalfx library (#7840) (#7844) ( 7021d0de )
  • cve: Fix an old CVE version of kayenta signalfx library (#7840) ( 9144f667 )
  • cve: More cve lib fixes (#7841) (#7843) ( 055f90dc )
  • cve: More cve lib fixes (#7841) ( e5f961fa )
  • deck: Instance types response filtering case-mismatch (#7963) ( 3d363b0c )
  • deck: restore regressions after Angular removal (#7832) ( 133061a8 )
  • docs: Publish API docs as part of release based upon the openapi swagger generated specs (#7883) ( 02f166df )
  • ecs: fix Create Server Group crash on ECS applications (#7961) ( ae9b2b11 )
  • ecs: populate imageId when scoping docker image find by account (#7964) ( 6c16f12b )
  • ecs: re-describe task definitions cached in a degraded form (#7901) ( 6ecf71ad )
  • ecs: read cached task containers with the SDK v2 model (#7898) ( f2ff316b )
  • ecs: stop dropping fields when reading cached task definitions (#7899) ( 4e989be2 )
  • elastic: Bump elastic for CVE fixes (#7784) (#7785) ( 5fc25e30 )
  • elastic: Bump elastic for CVE fixes (#7784) ( 6c9e3f09 )
  • entity-store: Fix a UI bug with entity store references and a few stages which didn’t work with it (#7913) ( 88dc34b5 )
  • front50: filter pipelines by application, not pipeline name, in PostFilter (#7945) ( 6719810c )
  • gate: guard PermissionService.isAdmin(String) with fiatStatus.isEnabled() (#7783) (#7786) ( 4b1c4fc4 )
  • gate: guard PermissionService.isAdmin(String) with fiatStatus.isEnabled() (#7783) ( 8073dcfc )
  • google: restore Platform Health Override on disable/enable server group stages (#7956) ( 4d706c56 )
  • install: Use correct ARCH type for arm64 architecture during Rosco packer install (#7792) (#7793) ( ba642a61 )
  • install: Use correct ARCH type for arm64 architecture during Rosco packer install (#7792) ( 1a49b6b8 )
  • kayenta: Fix kayenta stage UI formatting (#7779) (#7780) ( fc9c8004 )
  • kayenta: Fix kayenta stage UI formatting (#7779) ( 09d5cd5c )
  • libdiffs: order versions of differing component counts correctly (#7805) (#7815) ( f4f926da )
  • libdiffs: order versions of differing component counts correctly (#7805) ( b3403787 )
  • oracle: restore all pipeline stage config fields dropped by Angular removal (#7958) ( 8a6652fd )
  • orca: honor the page parameter when paging pipeline executions by config id (#7850) ( 6b638b93 )
  • packer: pass through Boolean false and numeric 0 -var values (#7806) (#7812) ( e5d7ac42 )
  • packer: pass through Boolean false and numeric 0 -var values (#7806) ( da8c266c )
  • parsing: Fixes the issue reported in https://github.com/spinnaker/spinnaker/pull/7686 and adds some null checks and blank handling (#7856) (#7860) ( b37b4ece )
  • parsing: Fixes the issue reported in https://github.com/spinnaker/spinnaker/pull/7686 and adds some null checks and blank handling (#7856) ( b07a16ce )
  • rosco: create writable home dir for spinnaker system user in Dockerfile.ubuntu (#7967) (#7968) ( 251f8bd2 )
  • saml: Restore login URL to allow the old paths to continue to work for now while providing a path forward (#7833) ( f92b386b )
  • signalfx: Move from signalfx library to standard retrofit to remove an old dep issue. (#7893) ( e6245d11 )
  • spin: SPIN cli builds had a number of issues post changes to openapi spec. Fix these issues and make sure to use the monorepo packaging structure. (#7757) (#7762) ( f909fe40 )
  • spin: SPIN cli builds had a number of issues post changes to openapi spec. Fix these issues and make sure to use the monorepo packaging structure. (#7757) ( 1d905611 )
  • spin: send Bearer token on all API requests when using oauth2 auth (#7918) ( cca9348d )
  • spinnaker-kustomize: Move default kustomize install to mysql due to compatibility issues with mariadb latest (#7823) ( 7ded656f )
  • sql: qualify GROUP BY columns so getAllByApplication works on PostgreSQL (#7902) ( d125b54c )
  • sql: use inlined literal for compression_type to fix Postgres enum cast failure (#7778) (#7801) ( 277c26f0 )
  • sql: use inlined literal for compression_type to fix Postgres enum cast failure (#7778) ( 7b6eb55d )
  • test: Remove flakey timing test entirely (#7810) ( 239f920e )
  • tests: Running tests as non root. Previous attempt missed a few things to make this work correctly (#7888) ( 764b6245 )
  • trigger: Fixes docker UI trigger on expected artifacts to use docker UI not the helm UI (#7824) ( 4a0f15b2 )
  • ui: Fix two UI bugs, one on aws bake stage handling, one on new accounts UI styling (#7954) ( 84a3b6d7 )
  • ui: fix crash in CreatableSelect when used as a single-value select (#7962) ( 6080561b )
  • yaml: Fix a few places that do not handle large yamls with new snakeyaml (#7748) (#7811) ( c866972b )
  • yaml: Fix a few places that do not handle large yamls with new snakeyaml (#7748) ( 79358124 )

Other

  • aws: Flip credentials to AWS SDK v2 and remove aws-java-sdk (v1) entirely (#7944) ( 55cbae54 )
  • aws: Lambda migration to AWS SDK v2 (#7924) ( 6596a074 )
  • aws: Migrate AutoScaling client and ASG/AutoScaling caching agents to AWS SDK v2 (#7929) ( 5d00286a )
  • aws: Migrate CloudWatch alarms and AutoScaling scaling policies to AWS SDK v2 (#7937) ( 3a2bf03f )
  • aws: Migrate EC2 client and EC2-only caching agents to AWS SDK v2 (#7928) ( 887c909f )
  • aws: Migrate ELB classic + ELBv2 to AWS SDK v2 (#7932) ( cfdcefbf )
  • aws: Migrate Route53 to AWS SDK v2 (#7939) ( 4a3bed13 )
  • aws: Migrate S3 to AWS SDK v2 (#7938) ( 9efda914 )
  • aws: Migrate most of ECS to SDKv2 (#7925) ( d3048513 )
  • aws: Migrate remaining v1 ELB client usage in ASG atomic operations to SDK v2 (#7936) ( 005050da )
  • aws: Migrate rest of services to SDKv2 (#7933) ( 415f7de7 )
  • aws: Migrate secrets and config server off of v1 sdk. Also remove “dead” bastion configurations (#7922) ( c7f540a7 )
  • aws: More sdkv2 migration stuff. A few calls that didn’t need the SDK v2 stuff. (#7923) ( b5131c17 )
  • aws: Move kayenta from v1 to v2 of the AWS SDK. (#7887) ( 24c0a68f )
  • aws: Move orca and kork from sdk v1 to v2 (#7891) ( 40d1aa87 )
  • aws: remove Edda dynamic-proxy client and credential/config plumbing (#7941) ( a1595919 )
  • build: move deck-kayenta into deck (#7853) ( 64af7e2e )
  • builds: Add a build cache to reduce some of the build times (#7950) ( 1a4d7a32 )
  • change: Feat/fix deprecated kustomize common labels (#7880) ( d3cb8277 )
  • change: Remove Angular dependency from Docker/CF/Huawei/Tencent (#7771) ( 8713367b )
  • cleanup: Migrate custom saml to spring (#7826) ( 94b9ccf1 )
  • cves: Upgrade various deps based on security scans (#7775) (#7776) ( 08fe0e57 )
  • cves: Upgrade various deps based on security scans (#7775) ( d23ee3d6 )
  • deck/appengine+oracle: remove angular from appengine and oracle (#7773) ( 68927556 )
  • deck: Update jquery & jquery-ui (#7808) ( 7723ce46 )
  • deck: delete dead Angular production graph (#7847) ( 848333f2 )
  • deck: register Core routes directly (#7836) ( 10fc7937 )
  • deck: remove Angular (#7848) ( 928abace )
  • deck: remove Angular from ECS (#7809) ( 5404df88 )
  • deck: remove Angular from amazon (#7794) ( 3e7abc60 )
  • deck: remove Angular from app canary (#7798) ( 007e9e76 )
  • deck: remove Angular from azure (#7795) ( d8ada768 )
  • deck: remove Angular from google (#7797) ( e913705c )
  • deck: remove Angular from parts of core (#7807) ( 40ac99c4 )
  • deck: remove Angular from titus (#7796) ( 68079b1e )
  • deck: remove Angular reactive and modal facades (#7846) ( 0969e19b )
  • deck: remove Angular router facade consumers (#7839) ( 2b7eee34 )
  • deck: remove Angular service facade consumers (#7842) ( 69221e45 )
  • deck: remove Angular-owned UI seams (#7829) ( 5755e5ac )
  • deck: remove React Angular bridges (#7825) ( ab45221c )
  • deck: remove angular dependency from dcos and cloudrun (#7772) ( 1d2ce6fb )
  • deck: remove ngimport runtime bridge (#7837) ( ad71d034 )
  • deck: replace Angular bootstrap (#7831) ( 96b95725 )
  • deck: update dependencies (#7879) ( 09119728 )
  • deps-dev: bump webpack-dev-server from 5.2.1 to 5.2.5 in /deck (#7743) ( 348c0570 )
  • deps-dev: bump webpack-dev-server from 5.2.5 to 5.2.6 in /deck (#7854) ( cf982697 )
  • deps: bump actions/cache from 5 to 6 (#7760) ( 6c5d4be5 )
  • deps: bump actions/checkout from 6 to 7 (#7761) ( c7250b7d )
  • deps: bump actions/setup-go from 6 to 7 (#7874) ( 47668724 )
  • deps: bump actions/stale from 10 to 11 (#7876) ( 59d63ee2 )
  • deps: bump base images and tool versions to remediate CVEs (#7787) ( cdca0eb8 )
  • deps: bump github/codeql-action from 4 to 4.37.3 (#7875) ( 930aa021 )
  • ecs: Migrate remaining v1 EC2 SDK model type usage to SDK v2 (#7931) ( bbfbdc11 )
  • gha: Clean up some old GHA pointers (#7777) ( 4a47eddd )
  • groovy: Migrate pipeline triggers tests to groovy (#7894) ( ac79668b )
  • halyard: REMOVE HALYARD FINALLY (#7865) ( 01b53b9a )
  • lambda: Migrate from v1 to v2 aws sdk (#7827) ( 1fc3330a )
  • titus: Migrate remaining v1 AWS SDK model type usage to SDK v2 (#7930) ( 471b5b60 )